b1d1f644ed
[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ]
If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
this->raw_buffer, gpmi_free_dma_buffer() will be called to free
this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
and valid ptr.
Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
is called again to free this->auxiliary_virt in err_out. This causes
a double free.
As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
error path, so it should return err directly instead of releasing the dma
buffer again.
Fixes:
|
||
|---|---|---|
| .. | ||
| chips | ||
| devices | ||
| hyperbus | ||
| lpddr | ||
| maps | ||
| nand | ||
| parsers | ||
| spi-nor | ||
| tests | ||
| ubi | ||
| Kconfig | ||
| Makefile | ||
| ftl.c | ||
| inftlcore.c | ||
| inftlmount.c | ||
| mtd_blkdevs.c | ||
| mtdblock.c | ||
| mtdblock_ro.c | ||
| mtdchar.c | ||
| mtdconcat.c | ||
| mtdcore.c | ||
| mtdcore.h | ||
| mtdoops.c | ||
| mtdpart.c | ||
| mtdpstore.c | ||
| mtdsuper.c | ||
| mtdswap.c | ||
| nftlcore.c | ||
| nftlmount.c | ||
| rfd_ftl.c | ||
| sm_ftl.c | ||
| sm_ftl.h | ||
| ssfdc.c | ||